SUBSCRIBER+ EXCLUSIVE ANALYSIS – For months, U.S. officials have sounded vague but ominous alarms about the threat of terrorism in the U.S. - most noteworthy, perhaps, FBI Director Christopher Wray’s warning of “blinking lights everywhere” suggesting potential threats to the nation. When Wray used the phrase, in Senate testimony last December, he no doubt had ISIS-K on his list of worries; now, in the wake of a major terror attack in Moscow, the group’s place on that list has probably jumped a few notches.
The Islamic State Khorasan - known also as ISIS-K, or IS-K, is relatively young, founded in 2015 by members of the Pakistani Taliban, and perhaps best known for a suicide bombing at the Kabul Airport in August 2021, in the chaotic last days of the U.S. withdrawal of troops from Afghanistan. That blast killed 170 civilians and 13 American service members.
ISIS-K is - as its name suggests - an offshoot of the broader Islamic State, which had its self-proclaimed “caliphate” broken apart by U.S.-backed forces in Iraq and Syria. “Khorasan” refers to a region that dates to the 6th century, which over time encompassed territory that is now home to Iran, Afghanistan and various Central Asian nations. Today ISIS-K operates primarily in Afghanistan, with bases in Pakistan and Iran as well. And while other ISIS splinter groups have kept their operations local, ISIS-K has taken its terror further afield.
U.S. and other intelligence officials - and ISIS-K itself - say the group carried out the March 22 concert hall attack in Moscow, which killed more than 140 people, and the group claimed responsibility for twin bombings in Iran that killed 84 people in January. Over the years ISIS-K has also been blamed for major attacks in Western Europe - on the Bataclan theater in Paris in November 2015 and a suicide bombing at a concert in Manchester, England, in May 2017.
More recently, intelligence agencies in Austria, France, Germany and the Netherlands say they have disrupted ISIS-K plots against their countries, and Turkish security forces have launched operations against ISIS-K suspects.
Gen. Michael Kurilla, head of the U.S. military’s Central Command, told a House committee Thursday that ISIS-K “retains the capability and the will to attack U.S. and Western interests abroad in as little as six months, with little to no warning.”
Will it do so? Is the threat now likely to reach the U.S.? Experts are divided on the question.
To some observers, the Iran and Russia attacks were reminders that ISIS-K operates at a great distance from the U.S.; others noted that U.S. warnings issued prior to both attacks suggest American intelligence is doing a good job of monitoring the threat. But some experts see those “blinking lights” all too clearly, worried about a resurgent ISIS-K, and about a war in Gaza that is only making it easier to marshal recruits for the cause.
Last week, in the wake of the Moscow attack, the ISIS-affiliated al-Battar Media published a message threatening Italy, France, Spain and Britain, along with this question: “Who’s next?”
In a column for The Cipher Brief, Christopher Costa, a former senior director for counterterrorism at the National Security Council, warned that the U.S. might be "next."
“In light of the Moscow concert hall terrorist attack,” Costa wrote, “it’s more likely than ever that ISIS-K will target U.S. interests abroad as soon as the group aligns their capabilities with their aspirations.”
In a separate Op-Ed for The New York Times, Costa and Colin Clarke, director of research at the Soufan Group, argued that the U.S. should make use of a potential ally - albeit a highly problematic one - in its efforts to thwart ISIS-K. Since it took power in Afghanistan after the U.S. withdrawal, the Taliban have been pushing back against ISIS-K’s efforts to take territory in Afghanistan, according to U.S. counterterrorism officials. Unpalatable as it may seem to deal in any way with the Taliban, Costa and Clarke said, “It’s been considered before. And the alternative is worse: a devastating attack directed at Americans overseas or at home.”
The Cipher Brief asked three experts in counterterrorism - all with knowledge and expertise about the Islamic State and its affiliates - to weigh in on the ISIS-K threat, and what might be done about it.
THE CONTEXT
- January 3: ISIS-K claims responsibility for two suicide bombings in Kerman, Iran, targeting a commemoration of the anniversary of the assassination of Iranian Gen. Qassem Soleimani. At least 84 people are killed and 284 wounded in the attack.
- February 2: ISIS-K claims responsibility for two bombings in the Pakistani province of Balochistan ahead of general elections.
- March 19: German police arrest two Afghan nationals suspected of being Islamic State supporters who were accused of plotting an attack on the Swedish parliament.
- March 22: ISIS-K claims responsibility for the Moscow Crocus City Hall attack. Four gunmen kill 144 people and injure more than 500 others in the attack.
- German Interior Minister Nancy Faeser says ISIS-K poses "the greatest Islamist threat to security in Germany" and announces temporary border closures during the 2024 European Championship soccer competition, which starts June 14.
THE INTERVIEWS
The three Cipher Brief experts weighed in - not always in agreement - to assess the threat of ISIS-K to the U.S.
The Cipher Brief: On the one hand, the recent terror in Moscow has some people thinking, Well, that's far away. ISIS-K itself is far away. On the other side, some are raising five-alarm fire bells, saying this is a wakeup call and we should be very worried. I'm wondering where you stand.
Hoffman: In the middle. A lot of the narrative, especially since we withdrew from Afghanistan in August 2021, is that the terrorist threat is, if not over, at least manageable through over-the-horizon capabilities and that we can deal with groups that we believe were on the decline rather than on the upsurge. I don't think there's any doubt now that ISIS-K has emerged as the most active and the most threatening branch of ISIS.
Since 2018 in our defense posture, we have said that terrorism is no longer the preeminent national security concern [and] that great power rivalry is more critical. But what Moscow shows is when there's any kind of complacency, terrorists see an opportunity or an open window to strike. And terrorists being the consummate opportunists, they will always take advantage of whatever opportunities presented to them to strike in the West.
So on the one hand, we shouldn't be complacent. On the other hand, what happened in Moscow is a unique constellation of developments. ISIS has carried out at least half a dozen attacks in Russia since 2016. There have been recent arrests of ISIS-K operatives, attempting to attack a synagogue, for example. It is very clear that because of the geographical proximity of Russia to the Caucasus and the fact that they have a large contingent of people of Central Asian heritage serving in the military, working in Russia, all those things present a much more immediate threat than I think is as palpable elsewhere.
But that doesn't mean that ISIS-K isn't contemplating, hoping, wishing to be able to extend the geographical ambit of their operations into Western Europe and even into the United States. We just have to put it in its proper perspective, which is to say they're not at our doorstep.
Ali: ISIS-K has gone through a transformation over the last decade. For many years after [ISIS-K’s] inception in 2015, they were very locally focused. Incredibly violent, ruthless, launching devastating attacks against civilians and attempting attacks against the coalition military that was still there, but very much focused on operations inside either Afghanistan or sometimes across the border.
But the Western military coalition and the intelligence presence there was keeping an eye on them and putting pressure against them. And the Afghan government was trying to as well.
So they were causing problems, but there was also the capability to keep track of what they were doing and who they were, and through counterterrorism operations to put them on their heels. And that's why, up until the withdrawal in 2021, they weren't as able to be more global in their ambitions.
I don't think it's a coincidence that since the end of 2021 (after the U.S. withdrawal), we have seen successful ISIS-K attacks in Iran, Pakistan, and now in Russia. We've heard the news of disrupted plots in Europe. And to me that is a sign that this group has taken the ISIS vision that Abu Bakr al-Baghdadi (the late ISIS leader) was trying to promote in terms of this global attack agenda. And they are the ones carrying the torch for ISIS right now, because ISIS main in Iraq and Syria is at a very weak point, and ironically is more of a local threat now than a transnational one.
It's really difficult for anyone to say, Is there the potential for this ISIS-K threat to come here? It's now launched a horrific mass casualty attack in Russia. You take it one step further. Baked into the jihadist ideology are attacks against the U.S. homeland - they see us as the ultimate enemy. That's what Bin Laden was able to carry through as Al-Qaeda was progressing from attacks in Africa and then the Middle East, and then obviously with 9/11. Are we on the same horizon with ISIS-K?
West: The attack in Moscow is a reminder that regardless of where terrorism and counterterrorism ranks amongst U.S. or broader Western national security priorities, it remains an enduring challenge, made all the more difficult by the various competing agendas and priorities of the current threat environment. While it is unlikely that ISIS-K can launch large-scale, mass casualty attacks within the continental U.S., their capacity to attack U.S. and Western interests is increasingly evidenced by attacks such as that in Moscow.
While ISIS-K does subscribe to the global agenda and far-enemy strategy of ISIS, it has been primarily active in Afghanistan and the region. As of yet it has not sought to inspire operations in Western jurisdictions as ISIS did during its peak period, and is thus less likely to provide direct inspiration to so-called lone actors in the West.
It is also worth noting that Russia plays a unique role in the jihadist narrative, particularly as it pertains to Afghanistan and the broader Central Asian region. Since the Soviet invasion of Afghanistan in 1979, Russia has been an animating component of jihadist threat perceptions. Following the end of the Afghan-Soviet War, many “Afghan Arabs” dispersed to other conflict zones including Chechnya, which was subsequently the location for two brutal wars in which jihadists participated, fighting against Russian forces. During the Syrian civil war, Russian forces were also highly active against jihadist forces, and Chechen foreign fighters were substantial in number.
All this means that while there is no doubt that, should the opportunity arise, ISIS-K would strike against U.S. or other Western interests, Russia does play a key role in their threat perception and targeting priorities.
The Cipher Brief: How do you assess their capability right now?
Hoffman: Well, they are certainly on an upward climb, and our withdrawal from Afghanistan three years ago has not averted or in any way derailed that. To me, there's a similarity to AQAP (Al-Qaeda in the Arabian Peninsula) at the end of the 2000s, when Al-Qaeda central's threat to the United States had declined, but AQAP was seen to become a major player.
And that's the problem that we've seen over the years. Even peripheral groups in the Al-Qaeda and ISIS orbit, like Al-Shabaab in Somalia, demonstrate global capabilities that shouldn't surprise us, but do. They often have the same global ambitions as the central organizations that command them. And because of our success against the central organizations, more authority is being devolved to the locals or regional actors to carry out attacks that in a different era, we wouldn't have thought the local or regional branch is capable of. But repeatedly they show this global ambition. Twice in the past five years, Al-Shabaab terrorists have been apprehended in the Philippines and in Africa undergoing the same kind of training the 9/11 pilots from Al-Qaeda had.
Ali: We don't know how much capability they might have. From what we've learned, or based on media reporting, with the Moscow attacks, it was directed and supported by ISIS-K in Afghanistan, or at least plot managers there, but the operatives seemed to be local and they don't seem like they were trained professionally in ISIS-K camps in Afghanistan or Pakistan. Somebody recruited them locally and paid them and perhaps gave them the weapons and logistics to carry out the Moscow attack. But they weren't deployed externally.
Are there potentially people that ISIS-K is looking to bring into the United States for some kind of attack? Again, that's an open question.
ISIS has shown an interest in these commando-style attacks. I mean, that's what happened in Paris in 2015, and Moscow was similar, with the active-shooter dimension to it, but not as many people involved. I would imagine they're thinking of a scenario like that.
ISIS, much like Al-Qaeda, has also had a fascination with aviation plots. And that is something that is also baked into the jihadist terrorist DNA. They still believe that attacks against civilian airlines is a way to bring the United States, if not to its knees, to send a message and to bring fear into the public. And if you can pull off something like a 9/11, which is high-order end terrorism, that's a different type of threat.
I don't think ISIS-K has that kind of capability. I think it's more likely if they were going to try to do something here, it would involve sending small teams of people in. I don't think they have the ability to send people into the U.S. undetected like Al-Qaeda did for almost two years and have them get flight training and then come onto your aircraft. But it doesn't mean these other threats aren't deadly and aren't dangerous.
There’s also the “just do it” mantra of terrorism. That's where ISIS was also very effective at its height in 2015, 2016, 2017. They were inspiring so many attacks around the world, and they inspired attacks here. The Orlando nightclub shooting, the San Bernardino attack, that's also part of their playbook. It's not just pushing people in. It's also inspiring people who are already here to take action. And if they're successful, they'll take credit in the name of ISIS main or ISIS-Khorasan. That's what happened in both San Bernardino and Orlando - both shooters who had never traveled overseas and were not trained by ISIS, said that they conducted those attacks in the name of ISIS.
West: As with most branches in the jihadist ecosystem, whether Al-Qaeda or ISIS-affiliated, they constitute a fusing of local agendas and central priorities. This means that for a group like ISIS-K, an operation like the Moscow attacks is drawing resources - finance, fighters, arms, planning expertise, etc - from the local conflict agenda within Afghanistan and its more immediate region. It is often the case with branches and affiliates that there is a degree of internal tension between these competing agendas.
(ISIS-K's) ability to sustain both “domestic” operational tempo and external operations is likely constrained both by resources and by Western counterterrorism capability.
It would be a mistake to deduce from the attack in Moscow that the same capability could be successfully deployed in London or Paris, or the United States. The Russian security apparatus has demonstrated its limitations in Ukraine, and in addition, is overwhelmingly concentrated on that conflict.
For a jihadist group to achieve a large-scale, mass-casualty terrorist attack in a Western jurisdiction remains a substantial challenge. In addition to the geographic constraints of their area of operations, it is more likely that any ISIS-K attempt to launch a major operation in the West would be effectively disrupted than that they would be able to undertake an operation.
The Cipher Brief: The U.S. says it shared intelligence with Iran and Russia in advance of the terror attacks in those two countries. Does that suggest some good news here - that the U.S. has a good beat on ISIS-K at the moment?
Hoffman: Absolutely. The United States is in a completely different place today than it was 23 years ago. And the fact that there hasn't been a successful serious terrorist attack against the homeland from overseas is proof of that. Absolutely. But I would also say that in the terrorism world, you're only as good as your last success. So you're only as good as the last attack you've prevented. And that's the problem. We know that terrorists are constantly marshaling their resources and observing and studying our societies to find precisely the gap of the opportunity to strike again. So yes, of course we're much better, but even the intelligence community isn't going to say that they're omniscient or perfect.
In this kind of struggle, we can't rest on our laurels. Clearly the intelligence and warning functions are operating very efficiently, but they'll only continue to do so when they have the appropriate resources, and when the threat of terrorism is understood to be a preeminent one. I'm not saying that it has to be prioritized as it once was, but it can't also be neglected and forgotten.
With the withdrawal from Afghanistan, there was the implication that the threat had changed and had really eroded, and we could afford not to have this forward presence. I'm not arguing again for a forward presence. I'm just saying that we need to build on this success and not be complacent about it.
Ali: It's an interesting development that hasn't been fleshed out that much - that in the Moscow attack, this very precise intelligence was passed to the FSB via the chief of station in Moscow. And that's not happening every day, given the adversarial relationship between both countries. It must have been even more fascinating how we passed it to the Iranians, because we don't have an embassy in Tehran.
In two cases, the U.S. seems to have had pretty good insights on ISIS-K plotting at a tactical level. And so yes, we don't have that collection enterprise on the ground in Afghanistan the way we had it with the military presence there, but we still must have some pretty good insights. That is a good news story, but you can have the best intelligence in the world, and if you don't act on it or don't take it to the nth degree, then it's only as good as the paper it’s printed on. And that was kind of our story on 9/11. We had parts of 9/11 in different channels of the intelligence, but no one could put the whole thing together.
Today, we're not going to get back on the ground militarily (in Afghanistan), but it's in both our interest and the Taliban’s to really push back on this ISIS-K threat, or allow the Taliban to tackle it in Afghanistan, for the good of the country but also to stop these external attacks from happening.
Now is the time for that kind of conversation, if it's not already happening, because what other options do we have? We're not going to fund the Taliban or support the Taliban, but there has to be something that we can do, and the thing that makes the most sense to me is intelligence-sharing [that] allows them to go after ISIS-K and put pressure on them in a way that's just very difficult for us to do now.
West: It is worth emphasizing that U.S. intelligence reportedly provided warnings that ISIS-K was seeking to attack Moscow. This demonstrates that U.S. and Western intelligence remains abreast of ISIS-K, putting a ceiling on their global ambitions. There is little doubt that ISIS-K has substantial global ambitions, but their capacity to manifest those ambitions against a capable and competent adversary is limited.
The biggest asset that the U.S. and other Western nations have is a very mature, very sophisticated counterterrorism apparatus that has over two decades of experience combatting jihadist terrorism. Counterterrorism has matured greatly since 2001 and the broader public should feel confident that, overwhelmingly, counterterrorism authorities are effective at preventing terrorism.
The Cipher Brief: For organizations like ISIS-K, are you concerned about the motivation and inspiration that the war in Gaza may be providing?
Hoffman: I think the shift in attitude towards terrorism that we're seeing because of October 7th just convinces them that if they keep struggling, eventually they're going to be triumphant.
Ali: I don't think the ISIS agenda is driven by October 7th. I think it’s already part of their DNA that the group believed in its inception going back to the early 2010s. Then, Baghdadi openly provided the intellectual framework for that when he burst onto the scene in that speech at the Grand Mosque in Mosul and said, OK, I am now the self-declared Emir of this caliphate controlled by ISIS, and here's the agenda we are going to pursue. It's basically the bin Laden vision, but the difference that ISIS made is they declared a caliphate and took control of physical territory and tried to govern it in a way that Al-Qaeda never did or could, because it didn't have the manpower that ISIS did.
But ISIS was trying to launch plots against the US as well. What happens overseas usually starts to then come into the U.S. When I was in the White House, we made the policy choice to intensify the campaign against ISIS in order to keep the homeland safe. And we might be at a similar moment with respect to ISIS-K, because they now have the freedom of maneuver in a more permissive environment in Afghanistan.
West: The war in Gaza is having an impact, but it is also important to note that Hamas and ISIS-K are not the same in terms of their strategic objectives. Hamas is primarily, if not exclusively, concerned with Israel, and establishing a Hamas-run jihadist state in its place. It is a regionally focused enterprise which has a singular priority, which is Israel. While the conflict is being exploited by jihadist organizations for propaganda purposes, there is no overwhelming wave of jihadist foreign fighters inbound for Gaza or the West Bank, as there was in Syria, or Iraq prior to that. Additionally, Hamas has not sought to prioritize the inspired model of lone-actor operations, as ISIS, and AQAP before them, did. We have seen very limited examples of the war in Gaza providing inspiration or motivation for terrorist attacks in the West.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.
